ACME: Benefits Of An Internet Security Protocol In Your Network

The speaker, a security engineer at a French public healthcare insurer, starts with the problem. About 80,000 staff use hundreds of internal web applications, and HTTPS was applied unevenly, with expired or weak certificates. The internal certificate authority offered a manual portal workflow that was slow and depended on security staff approving each request. A separate API path served only one large project.

Older automated enrollment protocols for private PKI had weak security and few clients, so the team turned to ACME, the protocol behind Let's Encrypt. They explained its domain validation: the server issues a token, the client publishes it at a well-known HTTP path, and the server checks it. They deployed an ACME proxy in front of the existing CA. The proxy handles only the protocol while the internal PKI still signs certificates, so endpoints needed no changes. Several clients worked on Linux and Windows, and users adopted others such as acme.sh.

The main lesson is that an internal PKI can serve every administrator without enrollment or extra staff. More than 140 applications moved to TLS in under two months. Because ACME is an open standard, the security team can enforce the protocol rather than a specific tool. Architects also used it during server provisioning so new machines had certificates from the start. The DNS challenge was skipped because their DNS lacked an API.